mirror of
https://github.com/github/codeql.git
synced 2025-12-27 22:26:31 +01:00
43ddc54f2b
Module#const_get takes a single string argument and interprets it as the
name of a constant. It then looks up the constant and returns its value.
Object.const_get("Math::PI")
# => 3.141592653589793
By itself, this method is not as dangerous as e.g. eval, but if the
value returned is a class that is then instantiated, this can allow an
attacker to instantiate arbitrary Ruby classes.
As a result, I think it's safe to say that any remote input flowing into
this call is a potential vulnerability. A real-world example of this is
https://github.com/advisories/GHSA-52p9-v744-mwjj.
39 lines
1.3 KiB
Plaintext
39 lines
1.3 KiB
Plaintext
import codeql.ruby.frameworks.StandardLibrary
|
|
import codeql.ruby.DataFlow
|
|
|
|
query predicate subshellLiteralExecutions(SubshellLiteralExecution e) { any() }
|
|
|
|
query predicate subshellHeredocExecutions(SubshellHeredocExecution e) { any() }
|
|
|
|
query predicate kernelSystemCallExecutions(KernelSystemCall c) { any() }
|
|
|
|
query predicate kernelExecCallExecutions(KernelExecCall c) { any() }
|
|
|
|
query predicate kernelSpawnCallExecutions(KernelSpawnCall c) { any() }
|
|
|
|
query predicate open3CallExecutions(Open3Call c) { any() }
|
|
|
|
query predicate open3PipelineCallExecutions(Open3PipelineCall c) { any() }
|
|
|
|
query DataFlow::Node evalCallCodeExecutions(EvalCallCodeExecution e) { result = e.getCode() }
|
|
|
|
query DataFlow::Node sendCallCodeExecutions(SendCallCodeExecution e) { result = e.getCode() }
|
|
|
|
query DataFlow::Node instanceEvalCallCodeExecutions(InstanceEvalCallCodeExecution e) {
|
|
result = e.getCode()
|
|
}
|
|
|
|
query DataFlow::Node classEvalCallCodeExecutions(ClassEvalCallCodeExecution e) {
|
|
result = e.getCode()
|
|
}
|
|
|
|
query DataFlow::Node moduleEvalCallCodeExecutions(ModuleEvalCallCodeExecution e) {
|
|
result = e.getCode()
|
|
}
|
|
|
|
query DataFlow::Node loggerLoggingCallInputs(LoggerLoggingCall c) { result = c.getAnInput() }
|
|
|
|
query DataFlow::Node moduleConstGetCallCodeExecutions(ModuleConstGetCallCodeExecution e) {
|
|
result = e.getCode()
|
|
}
|